Optimal Recovery from Large-Scale Failures in IP Networks

Transcription

1 Optimal Recovery from Large-Scale Failures in IP Networks Qiang Zheng, Guohong Cao,TomLaPorta,andAnanthramSwami Department of Computer Science and Engineering, The Pennsylvania State University, University Park, PA Army Research Laboratory, Adelphi, MD {quz13, gcao, Abstract Quickly recovering IP networks from failures is critical to enhancing Internet robustness and availability. Due to their serious impact on network routing, large-scale failures have received increasing attention in recent years. We propose an approach called Reactive Two-phase Rerouting () for intra-domain routing to quickly recover from largescale failures with the shortest recovery paths. To recover a failed routing path, first forwards packets around the failure area to collect information on failures. Then, in the second phase, calculates a new shortest path and forwards packets along it through source routing. can deal with large-scale failures associated with areas of any shape and location, and is free of permanent loops. For any failure area, the recovery paths provided by are guaranteed to be the shortest. Extensive simulations based on ISP topologies show that can find the shortest recovery paths for more than 98.6% of failed routing paths with reachable destinations. Compared with prior works, achieves better performance for recoverable failed routing paths and uses much less network resources for irrecoverable failed routing paths. I. INTRODUCTION The Internet has become a significant and widely used infrastructure for a wide range of communication and other services. However, failures are fairly common in the Internet for various reasons. As foundation of the Internet, IP networks are intrinsically robust, but usually need a long time to recover from failures. Interior Gateway Protocols (IGP) for intra-domain routing are designed to recover from failures through updating the routing table of routers. When a router detects a failure, it disseminates topology updates to the other routers in the same Autonomous System (AS). The topology updates trigger these routers to recompute routing paths and update their routing tables. This IGP convergence process begins when the failure is detected and finishes after routers update their routing tables. Unfortunately, the IGP convergence is a time consuming process, which usually takes several seconds even for a single link failure [1]. During IGP convergence, a large number of packets may be dropped due to invalid routes. Disconnection of an OC-192 link (1 Gb/s) for 1 seconds can lead to about 12 million packets being dropped on a link (assuming that the average packet size is 1, bytes). Under large-scale failures, packet loss would be much more severe. Many events like natural disasters and intentional attacks can cause large-scale failures which usually lead to serious This work was supported in part by the Defense Threat Reduction Agency under grant HDTRA routing disruption [2], [3]. For example, Hurricane Katrina [4], the Taiwan earthquake in December 26 [5], and the Wenchuan earthquake in May 28 [6] destroyed a large portion of the Internet near the disaster location and resulted in serious routing disruption. Additionally, intentional attacks like terroristic events (e.g., 911 attack [7]), link cuts attacks [8], and attacks by weapons of mass destruction [9] can also lead to large-scale failures. Many approaches have been proposed to recover disrupted routing during IGP convergence. However, they cannot effectively deal with large-scale failures, i.e., routers and links within an area all fail as shown in Fig. 1. A straightforward recovery method is to accelerate the IGP convergence via appropriately tuning the parameters related to failure detection, topology update dissemination, and routing path recomputation [1]. However, rapidly triggering the IGP convergence may cause route flapping and make networks more unstable [11]. Therefore, most existing recovery approaches are proactive and use precomputed backup paths to reroute traffic affected by failures during IGP convergence, e.g., [13] [15]. These proactive approaches are built on an implicit assumption that there are only sporadic and isolated link failures in IP networks. Hence, they are not suitable for large-scale failures, because links and their backup paths may fail simultaneously. Two features make recovery from large-scale failures quite difficult. First, the failure area can be of any shape and at any place, and thus we cannot foresee which routers and links will be destroyed. This feature makes proactive recovery approaches unable to effectively deal with largescale failures. Second, no individual router has the overall information of failures, and each router only knows whether its neighbors are reachable. For an unreachable neighbor, the router cannot differentiate whether the neighbor fails or the link connecting the neighbor fails. In Fig. 1, the router v 11 finds that its neighbor v 4, v 6,andv 1 are unreachable, but it does not know that v 1 fails while v 4 and v 6 are live. Moreover, v 11 cannot see that v 1 is unreachable from. We propose an approach called Reactive Two-phase Rerouting () for intra-domain routing to quickly recover from large-scale failures with the shortest recovery paths. The basic idea is to collect failure information, and then calculate valid recovery paths and forward packets over them. To collect failure information, we design a protocol to forward packets around the failure area and record failure information in the packet header. This is a very efficient

2 v 1 v 3 v 4 v 6 v 7 v 8 v 1 v 9 v 11 v 14 v 15 v 12 v 16 Figure 1. An example of large-scale failures. The failure area is denoted by shaded area. process that allows us to fully characterize the failed region quickly. After gathering failure information, the second phase of is invoked to calculate new shortest paths to bypass the failure area, and then forward packets along the new shortest paths through source routing. can deal with large-scale failures associated with an area of any shape and location and is free of permanent loops. Under a single link failure, guarantees to recover all failed routing paths with the shortest recovery paths. For any failure area, the recovery paths provided by are guaranteed to be the shortest. Experimental results show that can find the shortest recovery paths for more than 98.6% of the failed routing paths with reachable destinations. Compared with prior works, can find more shortest recovery paths with lower computational and transmission overhead. For the failed routing path with unreachable destinations, can quickly identify them to save network resources. Compared with prior works, can save 83.1% of computation and 75.6% of transmission for irrecoverable failed routing paths. The rest of this paper is organized as follows. We describe the system model and our problem in Section II. In Section III, we present the design and properties of. Section IV evaluates the performance of. Section V reviews related work. Finally, Section VI concludes the paper. II. PRELIMINARIES In this section, we first present the network and failure models, briefly introduce the recovery process, and then describe the design objectives. A. Network Model and Failure Model We model the network under study as an undirected graph with a set of nodes (routers) and a set of edges (links). The link from node v i to node v j is denoted by e i,j, which has acostc i,j. Links can be asymmetric, i.e., c i,j c j,i.we focus on intra-domain routing with a link-state protocol like OSPF and IS-IS. The routing path p i,j from node v i to node v j is the shortest path calculated based on the link cost. Its length is the sum of the costs of links along p i,j. In intra-domain routing, every node knows the network topology. We assume that routers have a consistent view v 13 v 17 v 18 of the network topology before large-scale failures occur. In addition, each node knows the coordinates of all nodes. uses this information to assist in collecting failure information. This assumption is reasonable for the following reasons. First, in intra-domain routing, the administrator of an AS knows the coordinates of all routers in the AS and can record this information at each router. Second, we aim at providing recovery for high speed IP networks. Routers in such networks are immobile and are rarely moved after being deployed. Third, does not require highly accurate coordinates information of routers and thus does not need special location devices like GPS. When the network administrator moves a router (although this rarely happens in high speed IP networks), the coordinates information stored at routers can also be updated. We do not modify the mechanisms for failure detection and topology update dissemination in the current IP networks. A router only knows whether its neighbors are reachable, but cannot differentiate between a node failure and a link failure. To prevent route flapping, routers do not immediately disseminate topology updates upon detecting a failure. Thus, routers cannot quickly have the overall information of failures. To be more practical, we do not make any assumption on the shape and location of the failure area. Similar to prior work [16], the failure area is modeled as a continuous area in the network. Routers within it and links across it all fail. A routing path fails if it contains a failed node or link. A node is adjacent to the failure area if it has a link across the failure area. B. Recovery Process Overview is for rerouting traffic affected by failures during IGP convergence. When a router detects that the default next hop towards a destination is unreachable, the router invokes to recover the routing path towards the destination. After IGP convergence finishes, every live router has a reachable default next hop for each destination in the routing table. is not invoked and the link-state protocol is responsible for routing. Therefore, only operates during IGP convergence for traffic whose routing paths fail. In Fig. 1, the routing path from v 7 to v 17 is v 7 v 6 v 11 v 15 v 17 which is disconnected at e 6,11.Whenv 6 detects that v 11 is unreachable, it invokes to reroute traffic towards v 17, until IGP convergence completes. C. Objectives Large-scale failures may destroy a large number of routing paths. There are two cases if the source of a failed routing path is live. In the first case, the destination is still reachable from the source. For this case, should find a recovery path as short as possible to reach the destination. This is the goal of existing recovery approaches. In the second case, the destination is unreachable from the source, because it fails

3 or is in a different partition from the source. Packets towards an unreachable destination should be discarded as early as possible. However, this case has not been studied in any prior work. A possible reason is that most existing works focus on sporadic link failures where it is unlikely that there are many unreachable destinations, and hence discarding packets late has little negative impact. Large-scale failures may make many destinations unreachable, especially when the network is partitioned by failures. Keeping forwarding packets with unreachable destinations wastes network resources and degrades network performance. Due to searching on-demand for usable routing paths, reactive recovery unavoidably introduces computational overhead to routers. Routers in high speed IP networks need to forward packets very quickly. Using too much CPU time for recovery computation interferes with forwarding the packets which are not affected by failures. Therefore, a reactive recovery mechanism should have low computational overhead and have as low transmission overhead as possible to save bandwidth. III. : REACTIVE TWO-PHASE REROUTING This section describes the design and properties of. A. Overview consists of two phases. The first phase is to collect failure information, i.e., identifying which links have failed. In this phase, packets are forwarded around the failure area, and routers adjacent to the failure area record failed links in the packet header. Then, the second phase calculates a new shortest path based on the collected failure information, and uses source routing to ensure that packets are forwarded along the new shortest path. In Fig. 2, suppose v 7 is the source and v 17 is the destination. The routing path v 7 v 6 v 11 v 15 v 17 is disconnected at e 6,11, and thus v 6 invokes for recovery. Node v 6 is referred to as a recovery initiator, andarecovery path is from the recovery initiator to the destination. In the first phase, starting from v 6, packets towards v 17 are forwarded around the failure area along the dotted lines. When receives a packet, it inserts the id of e 5,1 in the packet header. Similarly, v 9 inserts the id of e 9,1 in the packet header. After packets return to v 6, v 6 knows that five links have failed by checking the packet header. Then, in the second phase v 6 removes the failed links from the network topology and calculate a new shortest path to reach v 17, i.e., the dashed lines. When v 6 receives a packet for v 17,it forwards it along the recovery path through source routing. If a node is adjacent to the failure area and its default next hop towards a destination is unreachable, the node is a recovery initiator and it invokes to recover the failed routing path. Multiple recovery initiators independently invoke to recover their failed routing paths. v 1 v 4 v 3 recovery initiator v source 6 Figure 2. v 7 v 8 v 1 v 9 v 11 v 14 v 15 v 13 destination v 17 v 18 v 16 v 12 Default routing path Forwarding path in the first phase New shortest path The recovery process of on a planar graph. We use data packets rather than designing a special control message to collect failure information due to two reasons. First, designing a special control message complicates the control plane of routers. Second, if a special control message is used, v 6 has to discard packets towards v 17 before finishing collection of failure information, because v 6 may not have enough buffer space to store these packets. In, the delay of the packets forwarded to gather failure information is increased, but no packet is dropped. As simulations in Section IV show, the first phase is quite short, and hence the increased delay is small. The first phase of needs to run only once at a recovery initiator and can benefit all destinations, because failure information can be used for calculating recovery paths for different destinations. The major challenge is to forward packets around the failure area and then back to the recovery initiator. B. Collecting Failure Information on Planar Graphs To facilitate exposition, we first explain how to collect failure information on planar graphs with no cross links, and then extend the method to a general graph in the next subsection. Starting from the recovery initiator, we use righthand rule to select a live neighbor to forward packets. Suppose v i is the recovery initiator whose default next hop v j is unreachable, there are two cases. 1) To select the first hop, v i takes link e i,j as the sweeping line and rotates it counterclockwise, until it reaches a live neighbor. Then, v i uses this live neighbor as the first hop. 2) In the other cases, suppose v m receives a packet from v n, v m takes link e m,n as the sweeping line and rotates it counterclockwise, until reaching a live neighbor. Then, v m takes this live neighbor as the next hop. In Fig. 2, the recovery initiator v 6 selects as the first hop as shown in Fig. 3(a), and chooses v 4 as the next hopasshowninfig.3(b). With the above rule, packets are forwarded out from the recovery initiator v i to visit every node that is adjacent to the failure area and reachable from v i, and finally back to v i,no

4 selected first hop sweeping line recovery initiator v 6 v 11 default v 7 next hop v 16 v 3 v 6 previous hop selected v 4 next hop v 1 sweeping line C. Collecting Failure Information on General Graphs The forwarding rule introduced above works well on planar graphs, but it may fail to forward packets around the failure area on a general graph as shown in Fig. 4. The cycle formed by the dotted lines fails to enclose the failure area. At, the forwarding rule selects v 12 as the next hop, and thus the dashed cycle fails to enclose the failure area. (a) Select the first hop. (b) In the other case. Figure 3. The rule of selecting a live neighbor to forward packets in the first phase. matter the failure area is inside the network or on the border of the network [17]. To control the forwarding process and collect failure information, we add the following fields in the packet header. The link id is represented by 16 bits. mode: When it is, the packet is forwarded by the default routing protocol. When it is 1, the packet is forwarded by the first phase of. rec_init: The id of the recovery initiator. failed_link: It records the ids of failed links. In the first phase, nodes take the following actions. 1) Initially, the recovery initiator v i sets mode in the packet header to 1 and set rec_init to v i. Then, v i selects the first hop and forwards the packet. 2) When node v j receives a packet, for each unreachable neighbor v k other than the recovery initiator v i, v j inserts the id of link e j,k in failed_link in the packet header if e j,k is not already recorded. Finally, v j selects the next hop and forwards the packet. 3) When the recovery initiator v i receives a packet whose rec_init is v i, it selects the next hop. If the next hop is the same as the first hop, it means that the packet has traveled the whole cycle around the failure area, and hence the first phase of completes. Otherwise, v i forwards the packet to the next hop to prevent missing some nodes on the cycle. To reduce the transmission overhead, a failed link is not recorded in failed_link if v i is one end of the link, because v i knows this failure. After the first phase finishes, v i removes the links in failed_link and its links to unreachable neighbors from its view of network topology. Then, v i calculates the shortest path to the destination and forwards packets with source routing. Fig. 2 shows the recovery process of on a planar graph where v 6 is the recovery initiator and v 17 is the destination. Along the forwarding path in the first phase, failed_link in the packet header records four links e 5,1, e 9,1, e 14,1,ande 11,1. These links together with e 6,11 are removed from the network topology when v 6 calculates the shortest path to v 17. The new shortest path shown by the dashed lines has 3 hops. v 1 v 3 source Figure 4. v 4 v 7 v 8 v 6 recovery initiator v 1 v 9 v 11 v 14 v 15 v 12 v 16 v 13 destination v 17 v 18 Default routing path Forwarding path in the first phase The forwarding rule may fail on a general graph. This phenomenon looks similar to the permanent loops in geographic routing in wireless networks [18]. However, they are different problems and the solutions in [18] cannot be used to solve our problem. The permanent loop problem in geographic routing refers to the fact that the forwarding rule fails to jump out of local minimum and thus the forwarding path contains a permanent loop. In our problem, the forwarding path fails to enclose the failure area. Unlike geographic routing, we cannot remove some cross links to planarize the topology in advance, because it may incorrectly partition the network when failures occur. For example, the planarization technique may turn the topology in Fig. 4 into a planar graph by removing e 6,11, e 4,11 and e 12,14. The planarized topology is partitioned when e 6,5 and e 6,7 fail, but in fact the network is still connected. We observe that the forwarding rule fails on a general graph because the forwarding path crosses the links between the recovery initiator and its unreachable neighbors. Intuitively, if the forwarding path surrounds the failure area, packets are forwarded clockwise around the failure area as shown in Fig. 2. However, when the forwarding path crosses the links between the recovery initiator and its unreachable neighbors, packets are possibly forwarded counterclockwise around the failure area. As a result, the forwarding path fails to enclose the failure area. To solve this problem, we propose the following constraint on the forwarding path. Constraint 1: The forwarding path should not cross the links between the recovery initiator and its unreachable neighbors. In Fig. 4, the forwarding disorder happens at when it selects v 12 as the next hop. By Constraint 1, link e 6,11 prevents e 5,12 from being selected, and thus chooses v 4 as the next hop. In this way, packets are forwarded round

5 the failure area. In addition to the above type of forwarding disorder, another forwarding disorder may also cause problems. As shown in Fig. 5, packets traverse a link in each direction, making the forwarding path quite long. When receiving a packet from, v 3 chooses v 4 as the next hop. The selected link e 3,4 crosses link e 1,2 that is traversed before by the forwarding path. This disorder causes the packet to be forwarded counterclockwise around the failure area. If e 3,4 is excluded, v 3 chooses the correct next hop and the forwarding path becomes v 1 v 3 v 6 v 1. Therefore, we have the second constraint on the forwarding path. Constraint 2: The forwarding path should not contain cross links. 7 v v 3 v 7 6 default next hop 1 11 v 1 5 recovery initiator Figure 5. The forwarding disorder that leads to a long forwarding path. The numbers beside the dotted lines show the visiting order. To prevent these two types of forwarding disorders, we add the cross_link field in the packet header to record some links. A link across any link in cross_link is excluded from being selected to forward packets. For each link, routers precompute the set of links across it. The action taken by each node in the first phase is as follows. 1) Initially, the recovery initiator v i sets mode in the packet header to 1 and set rec_init to v i. For each unreachable neighbor v j, if link e i,j crosses other links, v i inserts the id of e i,j in cross_link. Then, v i selects the first hop and forwards the packet. 2) When node v j receives a packet, for each unreachable neighbor v k other than the recovery initiator v i, v j inserts the id of link e j,k in failed_link in the packet header if e j,k is not recorded. Then, v j selects node v m as the next hop, where link e j,m is not excluded by the links in cross_link. Ifthereis a link which is across e j,m but not excluded by the links in cross_link, v j inserts the id of e j,m in cross_link. Finally, v j forwards the packet to v m. (Node v j is always able to find the next hop, because its previous hop satisfies the requirement.) 3) When the recovery initiator v i receives a packet whose rec_init is v i, v i selects the next hop. If it is the same as the first hop, the first phase of ends. Otherwise, v i forwards the packet to the next hop. The links recorded in cross_link by the recovery initiator are used for preventing the first type of forwarding v 4 disorder. All the other links in cross_link are used for preventing the second type of forwarding disorder. Finally, we use an example in Fig. 6 to show how works on a general graph. The content of failed_link and cross_link at each hop is shown in Table I. At, e 6,11 prevents e 5,12 from being selected. Similarly, at v 11, e 14,12 blocks e 11,15 and e 11,16. The forwarding path in the first phase in shown by the dotted lines. After collecting failure information, v 6 computes a new shortest path towards v 17 as shown by the dashed lines. v 1 v 3 source Figure 6. v 4 v 7 v 8 v 6 recovery initiator v 1 v 9 v 11 v 14 v 15 v 12 v 16 v 13 destination v 17 v 18 Default routing path Forwarding path in the first phase New shortest path The recovery process of on a general graph. Table I THE CONTENT OF THE TWO FIELDS AT EACH HOP Hop count At node failed_link cross_link v 6 e 6,11 1 e 5,1 e 6,11 2 v 4 e 5,1, e 4,11 e 6, v 9, v 13 e 5,1, e 4,11, e 9,1 e 6,11 e 5,1, e 4,11, 5 6 v 14, v 12 e 9,1, e 14,1 e 6,11, e 14,12 v 11, v 12, e 5,1, e 4,11, 7 11 v 8, v 7, v 6 e 9,1, e 14,1, e 11,1 e 6,11, e 14,12 It is possible that the first phase omits some failures. For example, if there is a link between v 1 and v 15 in Fig. 6, this failed link is omitted. Recording all failed links requires visiting every node that is adjacent to the failure area and reachable from the recovery initiator. This usually leads to a much longer forwarding path and a more complex forwarding rule than the current design. Although the first phase does not guarantee to collect all failures, we prove in Section III-E that can guarantee to find the shortest recovery path to bypass any single link failure as proactive recovery approaches can do. Furthermore, simulations in Section IV show that can find the shortest recovery paths for more than 98.6% of failed routing paths with reachable destinations. D. Recomputation and Rerouting In the second phase, adopts incremental recomputation [19] to calculate the shortest path from the recovery initiator to the destination, which can be achieved within a few milliseconds even for graphs with a thousand nodes [2].

6 By caching the recovery paths, the recovery initiator needs to calculate the shortest path only once for each destination affected by failures. After calculating the shortest path, forwards packets along it through source routing, which is widely used in prior works to improve Internet resilience to failures [21] [24]. The recovery initiator inserts the entire shortest path in the packet header. Routers along the shortest path simply forward packets based on the source route in the packet header. Since may omit few failures in the first phase, the recovery path possibly contains a failure. In that case, simply discards the packet. E. Properties This subsection summarizes three major properties of. Theorem 1: is free of permanent loops. Proof: In the first phase, permanent loops happen when packets cannot return to the recovery initiator. Suppose the forwarding path from the recovery initiator v i to another node v i+k is v i v i+1 v i+k consisting of k links. These links do not cross the links between v i and its unreachable neighbors; otherwise they are excluded from being selected. Moreover, any link across them will not be selected later. It means that these k links will not be excluded from being chosen again. Therefore, in the worst case, packets can be forwarded back to v i along v i+k v i+k 1 v i. The second phase is free of permanent loops because it forwards packets along the shortest path. Next we show the recovery performance and ability. Theorem 2: For any failure area, the recovery paths provided by are guaranteed to be the shortest. Proof: Let G denote the topology before failures occur. Suppose E 1 is the set of failed links collected by the first phase of, and E 2 is the actual set of failed links (ground truth). We have E 1 E 2, because may miss failed links but does not label live links as failed. Suppose the routing path from node s to node t is disconnected, and node i is the recovery initiator. Let p 1 i,t be the shortest path from node i to node t in G E 1,andp 2 i,t be that in G E 2. If successfully recovers the failed routing path from node i to node t, it means that p 1 i,t has no failure. Hence, p 1 i,t is also a path in G E 2.Sincep 2 i,t cannot be shorter than p 1 i,t, p1 i,t is the shortest path from i to t in G E 2.In conclusion, p 1 i,t is the shortest recovery path. Theorem 3: For a single link failure, guarantees to recover all failed routing paths with the shortest recovery paths. Proof: Theorem 2 shows that the recovery path is the shortest if it does not contain failures. Under any single link failure, the recovery initiator knows the failed link and hence the recovery path does not contain it. Therefore, guarantees to provide the shortest recovery paths. Although we focus on a single failure area, also works for multiple failure areas. Upon encountering a failure area F 1, collects failure information of F 1 and computes a backup path to bypass F 1. In order to avoid routing loops, the packet header needs to carry failure information of F 1. When it encounters another failure area F 2, the recovery initiator removes all failed links recorded in the packet header. Through it, the computed recovery path can bypass both F 1 and F 2. To reduce the packet header overhead, we can use the mapping technique in [22] to reduce storage. IV. PERFORMANCE EVALUATION In this section, we evaluate the performance of and compare it with other recovery approaches [13], [22]. A. Simulation Setup The simulation is based on eight ISP topologies derived from the Rocketfuel project [25], which are summarized in Table II. For each topology, we randomly place nodes in a 2 2 area. All topologies adopt shortest path routing based on hop count. To simplify our simulation, the failure area is a circle randomly placed in the 2 2 area with a radius randomly selected between 1 and 3. The radius and location of the circular area are unknown to. Nodes within the circle and links across the circle have all failed. There are three cases for a failed routing path. 1) The source fails and it cannot send packets. We ignore this type of failed routing paths in the simulation. 2) The source is live and the destination is still reachable from the source. This is a recoverable failed routing path. 3) The source is live but the destination is unreachable from the source. This is an irrecoverable failed routing path. For a failed routing path with a live source, the recovery process is invoked at the recovery initiator. Some failed routing paths with the same destination may have the same recovery initiator. Their recovery processes are the same; thus we take them as one test case. Given a topology, a test case is determined by three factors, i.e., the recovery initiator, the destination, and the failure area. For each topology, we generate failure areas to collect 1, recoverable test cases and 1, irrecoverable test cases, and evaluate the performance. We compare with a proactive recovery approach MRC [13] and a reactive recovery approach FCP [22]. For FCP, we use the source routing version, which reduces the computational overhead of the original FCP. B. Duration of the First Phase The duration of the first phase of affects the delay of packets forwarded during the first phase. has the same first phase in both recoverable and irrecoverable test cases. The one-hop delay consists of the delay at a router and

7 Table II SUMMARY OF TOPOLOGIES USED IN SIMULATION Topology AS29 AS71 AS1239 AS332 AS3549 AS3561 AS4323 AS718 #Nodes # Links the propagation delay on a link. We use 1 microseconds as the delay at a router, because packets in the first phase introduce quite low computational overhead to routers and 99% of packets in IP networks with OC-12 rate (622 Mb/s) experience less than 1 microseconds delay through a router [26]. The propagation delay on a link is about 1.7 milliseconds, assuming that links are 5 kilometers long on average. Hence, the one-hop delay is 1.8 milliseconds. The cumulative distribution of the duration of the first phase is shown in Fig. 7. The first phase of is quite short. None of the 1 2, = 2, test cases has the first phase longer than 11 milliseconds. In every topology, the first phase is shorter than 75 milliseconds in more than 9% of test cases. The duration in AS718 is longer than that in the other topologies mainly because this topology has many tree branches. Each link on a tree branch may be traversed twice. Generally speaking, the first phase of is quite short if the topology has high connectivity and few free branches like the Internet backbone. AS29 AS332 AS71 AS Figure 7. Duration of the first phase (ms) AS4323 AS3549 AS718 AS Duration of the first phase (ms) The cumulative distribution of duration of the first phase. C. Recoverable Test Cases We evaluate the performance with 1, test cases from the following four aspects. Recovery rate: It is defined as the percentage of successfully recovered test cases. We also measure the optimal recovery rate, i.e., the percentage of successfully recovered test cases with the shortest recovery paths. Stretch: For a pair of source and destination, the stretch is the ratio of the recovery path length to the length of the shortest path. The optimal value is 1. Computational overhead: and FCP need to calculate the shortest paths on-demand. The computational overhead is defined as the number of shortest path calculations. Transmission overhead: and FCP use the packet header to record necessary information for recovery. The transmission overhead is defined as the number of bytes used for recording information. Table III summarizes the recovery rate, optimal recovery rate, maximum stretch, and maximum computational overhead. The recovery rate of is higher than 97.7% in every topology. MRC cannot effectively deal with large-scale failures, because a routing path and its backup paths may fail simultaneously. Hence, we only compare with FCP in the following part. Theorem 2 shows that if a failed routing path is successfully recovered by, the recovery path is the shortest. Simulation results confirm this property and show that the recovery rate and optimal recovery rate of are the same. achieves higher optimal recovery rate than FCP in every topology. The average optimal recovery rate of is 98.6% in all 1, test cases. Next, we compare the stretch of recovery paths provided by and FCP. Fig. 8 shows the cumulative distribution of the stretch of successfully recovered paths. guarantees to have optimal stretch 1. FCP achieves small stretch in most test cases, but is still worse than in every topology. As shown in Table III, FCP may have quite a large stretch, whichisevenworsethanmrc. 9 8 FCP (AS1239) 7 FCP (AS332) 6 FCP (AS29) 5 FCP (AS71) Figure 8. Stretch FCP (AS718) FCP (AS3561) FCP (AS4323) FCP (AS3549) Stretch The cumulative distribution of stretch of recovery paths. Next, we compare the computational overhead of and FCP. Fig. 9 shows the cumulative distribution of the number of shortest path calculations. In each test case, calculates the shortest path only once, regardless of whether or not it is successfully recovered. FCP uses many more calculations than, because FCP calculates the shortest path whenever the packet encounters a failure not recorded in the packet header. 5 5 FCP (AS332) FCP (AS1239) 5 FCP (AS71) FCP (AS29) Number of shortest path calculations FCP (AS3549) FCP (AS3561) FCP (AS718) FCP (AS4323) Number of shortest path calculations Figure 9. The cumulative distribution of computational overhead in recoverable test cases.

8 Table III SUMMARY OF PERFORMANCE OF, FCP, AND MRC IN RECOVERABLE TEST CASES Recovery rate (%) Optimal recovery rate (%) Max stretch Max computational overhead FCP MRC FCP MRC FCP MRC FCP AS AS AS AS AS AS AS AS Overall Finally, we compare the transmission overhead of and FCP. In the first phase, the transmission overhead of is caused by recording the id of some links. In the second phase, it is due to recording the source route. In FCP, the transmission overhead is from recording the id of encountered failed links and the source route. For each topology, we measure the average transmission overhead across all 1, test cases, until IGP convergence finishes. To clearly demonstrate it, we only show the result over the first second in Fig. 1. In, the transmission overhead in the first phase is higher than that in the second phase. With the simulation going on, many test cases of enter the second phase, and the transmission overhead quickly decreases. After about 1 milliseconds, all test cases finish the first phase and the transmission overhead converges to a fixed value, which is smaller than that of FCP in every topology. Bytes Bytes FCP (AS29) (AS29) FCP (AS4323) (AS4323) FCP (AS718) Time (s) (AS718) FCP (AS332) (AS332) Time (s) Bytes Bytes FCP (AS1239) (AS1239) FCP (AS71) (AS71) FCP (AS3561) (AS3561) Time (s) FCP (AS3549) (AS3549) Time (s) Figure 1. The average transmission overhead of and FCP on recoverable test cases. In summary, the optimal recovery rate of on all 1, test cases is as high as 98.6%. Compared with FCP, achieves higher optimal recovery rate with lower computational and transmission overhead. D. Irrecoverable Test Cases First, we investigate the percentage of failed routing paths that are irrecoverable. The radius of the failure area increases from 2 to 3 in increments of 2. For each radius, we generate 1, failure areas and count failed routing paths. The percentage of irrecoverable routing paths is shown in Fig. 11. Even when the radius is 2 (the failure area takes up about 3% of the simulation area), more than 2% of the failed paths are irrecoverable in nine topologies. When the radius is 3 (the failure area takes up about 7.7% of the simulation area), more than 45% of the failed routing paths are irrecoverable in nine topologies. The simulation result illustrates that large-scale failures make many failed routing paths irrecoverable. As a result, the performance of a recovery approach on irrecoverable routing paths is also very important. Percentage (%) AS71 AS29 AS1239 AS Radius Percentage (%) AS718 AS3561 AS4323 AS Radius Figure 11. The percentage of failed routing paths that are irrecoverable under the failure area of different radii. For an irrecoverable failed routing path, all efforts for recovery are wasted, because packets are ultimately discarded. For each topology, we use 1, irrecoverable test cases to evaluate the performance of and compare it with FCP in the following two aspects. Wasted computation: It is defined as the number of shortest path calculations. Wasted transmission: We assume that the packet size is 1, bytes plus the bytes in the packet header used for recovery. Let s denote this value and h denote the hops from the recovery initiator to the node discarding the packet. Thus, the wasted transmission of the packet is defined as s h. Fig. 12 shows the cumulative distribution of wasted computation. The wasted computation of is 1 because it

9 needs to calculate the shortest path only once. The wasted computation of FCP is much more than that of. For example, in AS3549 FCP has more than 1 calculations of the shortest path in about 8% test cases. FCP (AS29) FCP (AS2914) FCP (AS1239) FCP (AS71) FCP (AS332) Number of shortest path calculations FCP (AS718) FCP (AS4323) FCP (AS3561) FCP (AS3356) FCP (AS3549) Number of shortest path calculations Figure 12. The cumulative distribution of the wasted computation in irrecoverable test cases. Next, we compare the wasted transmission of with FCP and show the result in Fig. 13. As was the case with the wasted computation, outperforms FCP in every topology on this metric as well. In particular, the wasted transmission of FCP is much more than that of in AS332, AS3549 and AS3561. (AS71) FCP (AS71) (AS29) FCP (AS29) Wasted transmission (AS3549) FCP (AS3549) (AS3561) FCP (AS3561) Wasted transmission (AS332) FCP (AS332) (AS1239) FCP (AS1239) Wasted transmission (AS718) FCP (AS718) (AS4323) FCP (AS4323) Wasted transmission Figure 13. The cumulative distribution of the wasted transmission on irrecoverable test cases. Finally, Table IV summarizes the wasted computation and wasted transmission of and FCP, including the average and worst result. Compared with FCP, reduces wasted computation by 83.1% and wasted transmission by 75.6%. FCP does not work well because it has to try every possible link to reach the destination before discarding packets. As a result, FCP calculates a recovery path many times and forwards packets for many hops. V. RELATED WORK There have been many approaches for intra-domain routing to recover from failures. A straightforward method is to accelerate the IGP convergence via appropriately tuning the parameters related to failure detection, topology update dissemination, and routing path recomputation [1]. However, rapidly triggering the IGP convergence may cause route flapping and make the network more unstable [11]. Proactive recovery methods based on precomputed backup routes, such as [13] [15], can effectively handle sporadic link failures with low overhead. However, it is hard to apply them to large-scale failures, because a routing path and the corresponding backup routes may fail together when largescale failures occur. The first phase of the proposed looks like geographic routing in wireless networks [18], [27], but they are quite different. The only similarity is that both of them use the right-hand rule to select a node to forward packets. The first phase of aims at forwarding packets around the failure area, while geographic routing in wireless networks tries to greedily forward packets to the destination. Additionally, as explained in Section III-C the forwarding disorder problem in is distinct from the permanent loop problem in geographic routing. The solutions to the latter problem cannot solve the forwarding disorder problem in. There are some works related to large-scale failures in IP networks. Zlatokrilov et al. [23] proposed an approach to find paths to bypass certain failure areas in the network using distance-vector protocols. However, their method relies on the assumption that the failure area is a circle whose center and radius are known in advance. Moreover, their approach assumes that a router can query routing information from other routers. Under large-scale failures, however, it is a challenge to deliver query requests to other routers. Neumayer et al. [2], [3] analyzed the impact of large-scale failures on network routing, but they did not propose a recovery method. Further, they model the failure area as a circle, while we do not have any assumption on the shape of the failure area. Zheng et al. [12], [28] proposed an approach to identify links with abnormal performance, but they did not address how to recover the abnormal links. Similar to, the proactive recovery approach FCP [22] uses the packet header to collect failure information and calculates recovery paths on-demand. However, FCP needs to modify the mechanism of topology update dissemination in the current IP networks. Moreover, as shown in the simulation, outperforms FCP in both recoverable and irrecoverable test cases. R3 [15] uses multiple backup paths to recover networks from multiple link failures. However, routers are assumed to broadcast failure information immediately after detecting a failure; whereas does not make this assumption. VI. CONCLUSIONS In this paper, we proposed a Reactive Two-phase Rerouting () approach for intra-domain routing to quickly recover from large-scale failures with the shortest recovery paths. To be more practical, we model large-scale failures as occurring over a continuous area of arbitrary shape

10 Table IV SUMMARY OF THE WASTED COMPUTATION AND WASTED TRANSMISSION OF AND FCP IN IRRECOVERABLE TEST CASES Wasted computation Wasted transmission Avg Avg FCP Max Max FCP Avg Avg FCP Max Max FCP AS AS AS AS AS AS AS AS Overall and at arbitrary location. We prove that is free of permanent loops. Under a single link failure, guarantees to recover all failed routing paths with the shortest recovery paths. Moreover, for any failure area, the recovery paths provided by are guaranteed to be the shortest. Extensive simulations based on ISP topologies show that can find the shortest recovery paths for more than 98.6% of failed routing paths with reachable destinations. Compared with prior works, can find more shortest recovery paths with lower computational and transmission overhead. For failed routing paths with unreachable destinations, can quickly identify them and thus save network resources. Compared with prior works, can save 83.1% of computation and 75.6% of transmission for irrecoverable failed routing paths. REFERENCES [1] G. Iannaccone, C. Chuah, R. Mortier, S. Bhattacharyya, and C. Diot, Analysis of link failures in an IP backbone, in ACM SIGCOMM Workshop on Internet measurment, 22. [2] S. Neumayer, G. Zussman, R. Cohen, and E. Modiano, Assessing the vulnerability of the fiber infrastructure to disasters, in IEEE INFOCOM, 29. [3] S. Neumayer and E. Modiano, Network reliability with geographically correlated failures, in IEEE INFOCOM, 21. [4] J. Cowie, A. Popescu, and T. Underwood, Impact of Hurricane Katrina on Internet infrastructure, Renesys-Katrina-Report-9sep25.pdf, 25. [5] S. LaPerriere, Taiwan earthquake fiber cuts: a service provider view, presentations/laperriere.pdf, 27. [6] Y. Ran, Considerations and suggestions on improvement of communication network disaster countermeasures after the wenchuan earthquake, IEEE Communications Magazine, vol. 49, no. 1, pp , 211. [7] A. Ogielski and J. Cowie, Internet routing behavior on 9/11 and in the following weeks, presentations/pdf/renesys-352-nrc-911.pdf, 22. [8] S. M. Bellovin and E. R. Gansner, Using link cuts to attack Internet routing, AT&T Labs Research, Tech. Rep., 23. [9] C. Wilson, High altitude electromagnetic pulse (HEMP) and high power microwave (HPM) devices: threat assessments, [1] P. Francois, C. Filsfils, J. Evans, and O. Bonaventure, Achieving sub-second IGP convergence in large IP networks, ACM SIGCOMM Computer Communication Review, vol. 35, no. 3, 25. [11] A. Basu and J. Riecke, Stability issues in OSPF routing, in ACM SIGCOMM, 21. [12] Q. Zheng and G. Cao, Minimizing probing cost and achieving identifiability in probe based network link monitoring, IEEE Transactions on Computers, to appear. [13] A. Kvalbein, A. F. Hansen, T. Cicic, S. Gjessing, and O. Lysne, Fast IP network recovery using multiple routing configurations, in IEEE INFOCOM, 26. [14] S. Kini, S. Ramasubramanian, A. Kvalbein, and A. F. Hansen, Fast recovery from dual link failures in IP networks, in IEEE INFOCOM, 29. [15] Y. Wang, H. Wang, A. Mahimkar, R. Alimi, Y. Zhang, L. Qiu, and Y. R. Yang, R3: Resilient routing reconfiguration, in ACM SIGCOMM, 21. [16] Q. Zheng, G. Cao, T. L. Porta, and A. Swami, Detecting and localizing large-scale router failures using active probes, in IEEE MILCOM, 211. [17] Q. Fang, J. Gao, and L. J. Guibas, Locating and bypassing routing holes in sensor networks, in IEEE INFOCOM, 24. [18] B. Karp and H. T. Kung, GPSR: Greedy perimeter stateless routing for wireless networks, in ACM MOBICOM, 2. [19] P. Narvaez, K.-Y. Siu, and H. yi Tzeng, New dynamic algorithms for shortest path tree computation, IEEE/ACM Transactions on Networking, vol. 8, no. 6, 2. [2] C. Alaettinoglu, V. Jacobson, and H. Yu, Towards millisecond IGP convergence, IETF Draft, 2. [21] K. P. Gummadi, H. V. Madhyastha, S. D. Gribble, H. M. Levy, and D. Wetherall, Improving the reliability of Internet paths with one-hop source routing, in USENIX OSDI, 24. [22] K. Lakshminarayanan, M. Caesar, M. Rangan, T. Anderson, S. Shenker, and I. Stoica, Achieving convergence-free routing using failure-carrying packets, in ACM SIGCOMM, 27. [23] H. Zlatokrilov and H. Levy, Area avoidance routing in distance-vector networks, in IEEE INFOCOM, 28. [24] G. T. K. Nguyen, R. Agarwal, J. Liu, M. Caesar, P. B. Godfrey, and S. Shenker, Slick packets, in ACM SIGMETRICS, 211. [25] R. Sherwood, A. Bender, and N. Spring, Measuring ISP topologies with Rocketfuel, in ACM SIGCOMM, 22. [26] K. Papagiannaki, S. Moon, C. Fraleigh, P. Thiran, and C. Diot, Measurement and analysis of single-hop delay on an IP backbone network, IEEE Journal on Selected Areas in Communications, vol. 21, no. 6, 23. [27] Y.-J. Kim, R. Govindan, B. Karp, and S. Shenker, Geographic routing made practical, in USENIX NSDI, 25. [28] Q. Zheng and G. Cao, Minimizing probing cost and achieving identifiability in network link monitoring, in IEEE ICDCS, 21.